refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.
Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
SOFTWARE IS DISCLAIMED.
*/
+#include <linux/refcount.h>
+
#ifndef __RFCOMM_H
#define __RFCOMM_H
struct mutex lock;
unsigned long state;
unsigned long flags;
- atomic_t refcnt;
+ refcount_t refcnt;
u8 dlci;
u8 addr;
u8 priority;
static inline void rfcomm_dlc_hold(struct rfcomm_dlc *d)
{
- atomic_inc(&d->refcnt);
+ refcount_inc(&d->refcnt);
}
static inline void rfcomm_dlc_put(struct rfcomm_dlc *d)
{
- if (atomic_dec_and_test(&d->refcnt))
+ if (refcount_dec_and_test(&d->refcnt))
rfcomm_dlc_free(d);
}
skb_queue_head_init(&d->tx_queue);
mutex_init(&d->lock);
- atomic_set(&d->refcnt, 1);
+ refcount_set(&d->refcnt, 1);
rfcomm_dlc_clear_state(d);
{
struct rfcomm_session *s = d->session;
- BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
+ BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s);
list_del(&d->list);
d->session = NULL;